Staff Vulnerability Management Engineer
Chainguard5 hours ago
Responsibilities
- Own measurement, disclosure, and reporting for a pipeline of thousands of novel vulnerabilities identified weekly.
- Calibrate vulnerability response processes based on emerging trends.
- Report newly discovered vulnerabilities to upstream projects and maintainers.
- Run the CNA program and assign new CVEs when necessary.
- Coordinate internal and external embargoes with customers, engineering teams, and external maintainers.
- Coordinate actions and responses with the Linux Foundation, CISA, and other industry bodies.
- Guide industry direction so emerging standards and norms meet customer needs.
- Represent Chainguard externally in its vulnerability management efforts.
- Work with AI model vendors to guide the evolution of the software supply chain.
Requirements
- 7+ years of experience in software security, open source maintenance, or vulnerability disclosure management.
- Strong understanding of responsible disclosure.
- Practical expertise automating pipelines and processes at large scale to reduce human involvement.
- Deep experience with open source communities.
- Experience coordinating with public-sector organizations, industry standards bodies, and working groups.
- Preferred thought leadership in vulnerability disclosure management and embargoes.
- Familiarity with Chainguard Images or other minimal and hardened container base image ecosystems.
- Experience operating a CNA.
- Software engineering background in Python, Java, JavaScript, Go, or similar languages.
- Background in security research, penetration testing, or bug bounty programs.
Benefits
- Flexible remote-first work with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion, secondary offering participation, and a 10-year exercise window.
- 100% covered health, vision, and dental insurance premiums for the employee and dependents.
- Flexible paid time off.
- 18 weeks of paid parental leave for birthing parents and 12 weeks for non-birthing parents.
About Chainguard
Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk. Its customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. For more information, visit: https://www.chainguard.dev/